„The most important conclusion is simple: in 2026, the most exploited vulnerability is not computer systems, but people’s trust. Scammers are less and less looking for technical loopholes en masse and more often deliberately attacking people – using a sense of urgency, greed, and trust in well-known brands. And the preparation for attacks was aided by the sequentially sold fraud tools and unrestricted AI models – today, almost anyone can launch an attack,“ the statement says.
Read more Not just genetics: revealed how modern science stops hair aging
„Criminals exploit our natural instinct to believe what we see and hear. These attacks no longer require advanced skills or large resources – anyone with internet access can carry them out. Therefore, one human mistake can now have more serious consequences than ever before,“ says Marijus Briedis, Chief Technology Officer (CTO) of NordVPN.
The report also includes practical advice on how to protect yourself. The main message is that effective protection requires both appropriate technology and psychological resilience.
The report highlights:
Scale of threats. NordVPN processes more than 12 million unique internet addresses daily, which amounts to about 360 million per month. On average, 130,000 malicious websites are blocked every day.
Malware: the largest category of threats by scale. In January 2026 alone, NordVPN blocked more than 5 million attempts to install or use malware. Data theft programs remain one of the biggest threats – they are designed to steal sensitive financial and personal data, including bank login details, credit card information, cryptocurrency wallet data, and other digital assets.
Data phishing. More than 4.4 million attempts to steal data were blocked. Interestingly, 99% of attacks are carried out under just 300 brand names. The most commonly impersonated are: Microsoft (16.12%), Roblox (12.32%), Google (9.94%), and Netflix (5.99%).
Fraud. As much as 43.2% of fraud cases occur on .com domain websites – scammers exploit its trusted image. By mid-June 2026, NordVPN blocked nearly 29,000 scam calls and warned more than 525,000 users about unwanted calls.
Dark web. In just 90 days, dark web monitoring tools detected 8.4 million compromised accounts.
More than 47% of leaked data are physical addresses, first and last names: attackers combine digital and real-life information to create detailed victim profiles.
Session hijacking. From January to May, 94 billion cookies were exposed online. Of these, 1.2 billion session cookies allowed account takeover even without passwords – sometimes bypassing multi-factor authentication (MFA).
The full report with a practical protection guide can be found here.
